Astro Hacker News - Security Vulnerability in Pioneer Rekordbox

j-scott |next [-]

Rekordbox is one of the worst pieces of software I have to interact with regularly, and it reminds me of others descriptions of IoT software/firmware.

"PRO DJ LINK" enables you to access rekordbox libraries (and load music files) remotely from other devices, whether that be on a computer or dedicated Pioneer/AlphaTheta hardware.

The vulnerability in question requires the attacker to be on the same local network as the instance of rekordbox and for the remote library feature to be enabled. Interested in the full writeup once it's released

peterlk |root |parent |next [-]

Preach! I spent several hours this weekend trying to move my library between computers. So many popups and warnings telling me that I need to do something with no explanation of why. The docs are a mess. The library compatibility is a mess. Every few months they do something that fucks up libraries or makes them incompatible with some hardware. I just refuse updates now.

Rather than trying to make a new, shiny library, they should just release rekordbox 2.0, and then everyone would have a common lexicon to ask whether something is “rekordbox 2 compatible”. But instead we have this questionably compatible library plus as part of old, busted software that tries to brow best you into wrecking your old libraries.

I just use Claude to explain rekordbox to me now, and it is a bit more helpful than forums, though it also often gets confused from the conflicting advice/docs on the internet

MadnessASAP |root |parent [-]

They do not care, AlphaTheta is well down the enshittification road. They captured all the DJs, then they captured all the venues, and now they'll squeeze both for profits until a sufficient critical mass has built to trigger a collective switch away from them. At which point executive bonuses will be paid, investors will get their returns, and the PioneerDJ brand will be sold to an even scummier company to wring a few more dollars out of it.

MadnessASAP |root |parent |next |previous [-]

I too also have a special place of hate for Rekordbox. However I'm somewhat confused by this vulnerability, isn't plug n play unauthenticated file access essentially a core feature of "PRO DJ LINK"? The security mitigation, and best practice, being to have the involved devices connected on a entirely private LAN. I've never tried connecting them to a "public" network.

j-scott |root |parent |next [-]

The feature definitely does what it says it does, but I think that the mount is generally accessible outside the software may be where the “surprise” lies.

I definitely would not have used this feature on a public network or exposed the mount to the open internet as well.

MadnessASAP |root |parent [-]

You and crtasm both make an excellent point about where the problem lies. I suffered from a critical imagination failure by never considering the implications of running the link on anything other then a controlled and isolated network.

crtasm |root |parent |previous [-]

Access to files in your rekordbox library yes, but this sounds like it may be allowing access to any file on your computer/USB stick.

butterknife |root |parent |next |previous [-]

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

chipheadi |root |parent |next [-]

For this exact case I have built https://chiph.art/en/project/2026/dj-usb-toolkit

The parity repair in the app should make the USB compatible with all CDJs because it makes both of the DBs identical.

I have also been able to repair the DBs that have been corrupted for example by disconnecting USB while Rekordbox is exporting to it.

I'm also just now building a website where you can send the DB repair requests for cases that need special attention.

butterknife |root |parent [-]

I will make my DJ friends test this. Thank you.

chipheadi |root |parent [-]

Thank you!

Added repair service for Rekordbox USBs: https://chiph.art/en/dj-usb-tkit/repair

brokenmachine |root |parent |previous [-]

Do DJs just use whatever equipment is at the venue?

Don't they bring their own setup?

j-scott |root |parent |next [-]

DJs are typically playing on promoter or venue provided equipment, which is usually industry standard of pioneer/AT.

Otherwise, they bring their own, especially if it’s anything custom or specific to their performance.

butterknife |root |parent |previous [-]

There are some DJs who lug their own Pioneer controllers with them. Precisely because they can make sure that their library will work! No other reason.

cedws |root |parent |previous [-]

I dabbled with it for a while and hated how I couldn’t work with the library programatically. A few people found a way to decrypt the database (yes, it’s encrypted for obfuscation, rolls eyes) and manipulate it but it’s akin to brain surgery.

hexfish |next |previous [-]

I am by no means a professional DJ but once I hooked up my DDJ-400 to Mixxx (https://mixxx.org/) I never looked back. It was suprisingly complete for me (but ymmv when actually being a pro DJ).

brokenmachine |next |previous [-]

I bet it's a path traversal bug, like you request a listing for files named "../../.." or something.

I love it how they say to update, but there's no point because it won't fix the vulnerability anyway.

bpp |previous [-]

Rekordbox is extraordinary in that it has completely captured the DJ market and absolutely everyone hates it.

AlphaTheta (nee Pioneer DJ) makes arguably the best club DJ equipment – CDJs and mixers. Audiophiles may disagree but it's good enough that it's standard in all clubs, and artist riders (contracts) will absolutely require Pioneer CDJs if not their mixers as well. They're well made and great to perform on, and are basically advanced musical instruments at this point. If you know how to really use the equipment, you will be a better performer, and it's helpful to have a standard platform in all clubs.

But Rekordbox, which is required for those same performers to load their music onto USB drives and have them read it back with metadata etc., is one of the worst pieces of software I've ever used. It's clunky, it's slow to load the music, it often corrupts libraries or misplaces files. You'll load a song only to find that it inexplicably doesn't play. It'll hang for hours transferring a playlist that should be written in seconds. And they've just made it that much more complex by having a second library format, which they load in parallel, which has basically no benefit to the performer.

I have a friend who's a touring DJ who avoided updating Rekordbox for YEARS because his version was stable and he didn't want to introduce any variance into prep, because Rekordbox is so bad. If you tell a fellow DJ "Rekordbox ate my library" they will just shake their heads slowly, knowing that it's happened to them before and will happen to them again. It's a universal DJ experience.

It is completely unsurprising that this bug exists; I'd actually be surprised if their engineers put any thought into security at all. I bet Pro DJ Link just makes the drive available with no security whatsoever. The networks are typically just a few CDJs and lighting equipment, so the threat model is low. But this is obviously a real problem – just not one they probably put any thought into.

I would love to see this software replaced, but given their dominant market position I don't see how it will be.